The x2apic specification reserves the entire MSR range 0x800-0xbff, while only
the first 0x3f MSRs have defined purposes. All reserved MSRs in this region
are architecturally required to raise #GP faults upon access.
Xen used to pass this entire range to hvm_x2apic_msr_{read,write}(), but the
range was restricted somewhat by XSA-108 (c/s 61fdda7ac) to prevent guests
being able to read pages adjacent to the domheap page backing the vlapic->regs
array.
While removing the vulnerability, a side effect of XSA-108 was that the MSR
range 0x900-0xbff fell through the switch statement and ends up reading the
hosts x2apic range. This behaviour is a problem in general, but specifically
it turns out that MSRs 0xa00-0xa02 are implemented (but undocumented) on
certain SandyBridge and IvyBridge systems.
Experimentally, no operating system in XenServer's test suite (including all
versions of Windows currently supported by Microsoft) ever peek at these MSRs,
even on hosts where some of them are implemented.
This patch undoes the fix for XSA-108 (c/s 61fdda7ac), returning the primary
bounds check to the entire specified range. hvm_x2apic_msr_write() was always
safe, as it is whitelist based. hvm_x2apic_msr_read() changes to a whitelist
approach, which avoids the vulnerability, and provides a more architecturally
accurate emulation of the reserved MSRs (which would previously read as 0
rather than fault).
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Jun Nakajima <jun.nakajima@intel.com>
In XenServer system test it has become apparent that versions of Windows
that make use of the time reference counter enlightenment cannot cope with
large jumps forward in the value read from the MSR. Specifically,
suspending a very large domain took approx. 45 minutes to complete and
when the domain was resumed it was discovered that the WMI (Windows
Management Instrumentation) service had hung.
The reason a large jump forward is seen by the guest is that, when a guest
is suspended, the guest stops running when the SCHEDOP_suspend hypercall is
made, however the MSR value essentially keeps incrementing until the
tool-stack issues DOMCTL_gethvmcontext.
This patch adds code to freeze the value of the time reference counter
on domain pause and 'thaw' it on domain unpause, but only thaw it if the
domain is not shutting down. The absolute value of the counter is then
saved in the viridian domain context record. This prevents the guest OS
from experiencing large jumps in the value of the MSR and has been shown
to reliably fix the problem with WMI.
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
When booting with EFI, __flush_dcache_all does not correctly flush data.
According to Mark Rutland, __flush_dcache_all is not guaranteed to push
data to the PoC if there is a system-level cache as it uses Set/Way
operations. Therefore, this patch switchs to use the "__flush_dcache_area"
mechanism, which is coppied from Linux.
Add flushing of FDT in addition to Xen text/data.
Remove now unused __flush_dcache_all and related helper functions.
Invalidate the instruction tlb before turning on paging
later on when starting Xen in EL2.
Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Signed-off-by: Roy Franz <roy.franz@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
In order to support pvgrub (or other bootloader) from dom0 chainloading a
pvgrub (or other) from within the domU filesystem we need a standard for where
the stage 1 bootloader should look and what it should expect to find there.
Add a document along those lines.
This is currently x86-specific since it is expected that other new architecures
(including ARM) will either not need to implement this due to the existence of
more generic specifications for that arch (e.g. the ARM VM spec) or will update
this document in due course.
Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Colin Watson <cjwatson@debian.org>
Cc: 759018@bugs.debian.org
* nsplitd has been orphaned from the build since its introduction in c/s
dc44ed4764 (in 2004), and never been developed since. While it does appear
to compile, it is full of pointer width mismatch, pointer sign mismatch, and
uninitialised variable warnings, which makes it unlikely to function
correctly when compiled for a 64bit environment.
* xen-python-path was declared obsolete in c/s 11e1149fe (in 2009) and can't
actually be used correctly by out-of-tree components. 5 years is long enough
for out-of-tree callers to catch up.
There are no subdirectories any more, so drop the notion from the Makefile.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
This adds support for channel declarations of the form:
channel = [ "name=...,connection=...[,path=...][,backend=...]" ]
where 'name' is a label to identify the channel to the frontend.
If 'connection = pty' then the channel is connected to a pty in the
backend domain
If 'connection = socket' then the channel is connected to a Unix domain
socket given by 'path = ...' in the backend domain.
This patch also adds the command:
xl channel-list <domain>
which allows the state of channels to be queried. In particular if
'connection=pty' this will show the path of the pty slave device.
Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
A 'channel':
- is a low-bandwidth private communication channel that resembles
a physical serial port.
- is implemented as a PV console with a well-known string name
which is used to hook the channel to the appropriate software
in the guest (i.e. some kind of guest agent).
- has a backend 'connection' which describes what should happen
to the data.
The following 'connection' types are defined:
* PTY: the I/O surfaces as a pty in the backend domain
* SOCKET: a listening Unix domain socket accepts a connection in
the backend domain and proxies
Channels may be listed but don't currently support hotplug/unplug.
Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
The current implementation of libxl__device_console_init does the same
memset() so this is identical for now.
If libxl__device_console_init changes in future (e.g. to prefer a non-zero
default value for some field) then this will continue to work.
Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
In a long-running process (such as virt-manager) this might eventually
run the process out of fds.
That qemu argument construction might generate an fd that needs to be
fed to qemu is a bit odd, but we just run with it and provide a
parameter to the qemu argument construction code for this purpose.
There is no need to use the carefd machinery, because leaking the odd
copy of this descriptor into a child unexpectedly forked out of
another thread, is fine. We just don't want to leak it back to the
main process.
Reported-by: ustermann.max@web.de
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
When Xen is flushing the TLB for another domain than current, it has to
switch temporarily to the P2M of this domain. If IRQs are enabled, it may
be possible to receive an interrupt that requires the use the P2M of the current
domain, or even temporarily switch to another P2M.
For the former case, the translation would be wrong. For the latter one,
as the handler would restore the current P2M, Xen would flush the wrong domain
TLB.
Thankfully we don't have such interrupt handler, but it may be necessary
in the future to do that during when the user asks to dump domain stack via
a keystroke.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- spelling in the commit log ]
Since the commit 58f0fd8 "xen: arm: handle variable p2m levels in p2m_lookup",
Xen checks that the root_table offset is valid. If not, its unlock the p2m
spinlock before returning an error. But, at this time, the lock has not been
taken.
On Xen built with debug=y, we can get the following stack trace if the guest
use an invalid IPA in hypercall or mess-up the grant-table:
(XEN) Assertion '_raw_spin_is_locked(lock)' failed at xen/include/asm/arm32/spinlock.h:22
...
(XEN) [<0022d1bc>] _spin_unlock+0x2c/0x50 (PC)
(XEN) [<00253264>] p2m_lookup+0x20c/0x230 (LR)
(XEN) [<7ffdfd54>] 7ffdfd54
(XEN) [<002539f4>] gmfn_to_mfn+0x24/0x3c
(XEN) [<0020e4d4>] __get_paged_frame+0x30/0x12c
(XEN) [<00210680>] __acquire_grant_for_copy+0x4e0/0x768
(XEN) [<00212030>] do_grant_table_op+0x13a0/0x2534
(XEN) [<00257b10>] do_trap_hypervisor+0xe10/0x1148
(XEN) [<0025b330>] return_from_trap+0/0x4
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
The commit 7471879 "tools: CMDs and APIs for Cache Monitoring Technology"
has introduced a new section but forgot to add '=back'. This will result
a build issue with newer podman:
man/xl.pod.1 around line 1443: You forgot a '=back' before '=head1'
or creating a section "POD ERRORS" with older one.
At the same time, capitalize the title of the section to match the coding
style used within the files.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Commit 063188f4b3 "xen: arm: Add support for the Exynos secure firmware"
introduced code assuming that exynos_smc() would get called with arguments in
certain registers. While the "noinline" attribute guarantees the function to
not get inlined, it does not guarantee that all arguments arrive in the assumed
registers: gcc's interprocedural analysis can result in clone functions to be
created where some of the incoming arguments (commonly when they have constant
values) get replaced by putting in place the respective values inside the
clone.
Xen contains in multiple place of this SMC function: consolidate the function
in a single place and write it in assembly.
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- reworded commit message as discussed ]
After all this interface specifically exists for guest kernels to learn
about their (virtual) topology. I'm sure I made a comment to this
effect during review, but apparently I then didn't notice that this
never got carried out.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Some cleanups to the documentation-
- Remove unnecessary steps listed to apply ucode using initrd.
- Condense 'Misc notes' section as well
Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Aravind Gopalakrishnan <aravind.gopalakrishnan@amd.com>
Introduced some new xl commands to enable/disable Cache Monitoring
Technology(CMT) feature.
The following two commands is to attach/detach the CMT feature
to/from a certain domain.
$ xl psr-cmt-attach domid
$ xl psr-cmt-detach domid
This command is to display the CMT information, such as L3 cache
occupancy.
$ xl psr-cmt-show cache_occupancy <domid>
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
The code in the arm64 version of setup_xenheap_mappings was making
some very confused attempts to handle this but was bogus.
As well as adjusting the mapping to start on a 1GB boundary we also
need to account for the offset between the start of the mapping and
the actual start of the heap when converting between page pointers,
virtual addresses and machine addresses.
I preferred to do this by explicitly accounting for the offset rather
than adding an offset to the frametable because that approach could
potentially waste a large amount of frametable (up to just less than
1GB worth) but also because of issues with converting mfns from
outside the regions considered for pdx initialisation (which are not
1GB aligned) back and forth.
We already have an idea of the distinction between the start of the
direct map and the start of the xenheap in the difference between
DIRECTMAP_VIRT_START and XENHEAP_VIRT_START. Until now these were the
same thing, but now we change XENHEAP_VIRT_START to point to the
actual start of heap not the mapping. Surprisingly there was only one
place which was using the conceptually wrong value.
Also change xenheap_virt_end to a vaddr_t for consistency.
We've been lucky so far that most hardware happens to locate memory
on a 1GB boundary (we did have reports of a system with memory at a
half gig boundary which exhibited failures which I didn't manage to
follow up on successfully). The EFI support has exposed this
shortcoming by the way it handles reserved memory, which has a
similar effect to having memory non-1GB aligned.
arm32 does things differently here due to using a small Xen heap and
a demand mapped domain heap, so isn't affected.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Suravee Suthikulanit <suravee.suthikulpanit@amd.com>
Cc: Roy Franz <roy.franz@linaro.org>
Cc: Vijay Kilari <vijay.kilari@gmail.com>
Reviewed-by: Julien Grall <julien.grall@linaro.org>
Tested-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Roy Franz <roy.franz@linaro.org>
I forgot to request this to be done along with the files being moved.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Currently --with-systemd=DIR1 --with-systemd-modules-load=DIR2 will set
both XEN_SYSTEMD_DIR and XEN_SYSTEMD_MODULES_LOAD to DIR1. The reason is
that both AC_ARG_WITH() use 'systemd' as the name for the internal
variable. As a result the value of the first option is also use as the
value for the second option. Fix this by using another variable name.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ijc -- ran autogen.sh as requested]
The variables should have been removed already in
7ed06911dc ("Remove dead qemu code from
toplevel Makefile"), but I did not spot it at this time.
Now it looks like the intention initially was to let the install-tools
depend on tools/qemu-xen-traditional-dir. But that did not work because
there was the typo in the variables (TGT vs. TARGET), and
CONFIG_QEMU_TRAD was not defined anyway.
So remove QEMU_TRAD_DIR_TARGET and QEMU_XEN_DIR_TARGET because they are
not defined at all.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
When xen is configured with --disable-ocamltools then oxenstored will
still be the default if all required ocaml devel packages are installed.
The reason is that xenstored.m4 is included before the ocamltools check.
And xenstored.m4 does not use the result of --disable-ocamltools.
Rearrange the code to check first for the presence of ocaml, then check
--disable-ocamltools and finally decide what sort of xenstored should be
the default.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- ran autogen.sh as requested]
"machine_halt()" and "machine_restart()" are modified to use PSCI interface
by default if PSCI-0.2 is supported. The "raw_machine_reset()" is also removed
since this is unnecessary.
Also, machine_halt() is modified to add 10ms delay to make sure all auxiliary CPUs
are offlined before calling the shutdown.
For non-PSCI, platform_poweroff() and platform_reset() are used instead.
Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
This patch adds SMC calls to suport a subset of PSCI-0.2 functions
(PSCI_VERSION, CPU_ON, SYSTEM_OFF, SYSTEM_RESET).
By default, the psci_init() will use PSCI-0.2. Otherwise, it will
use PSCI-0.1 if PSCI-0.2 fails or un-supported.
To add support for PSCI_VERSION, this patch replaces the "bool_t psci_available"
variable with "int psci_ver", which contains the PSCI_VERSION as described in the
PSCI-0.2 spec.
Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
A stray call to blexit() was in the normal processing path for handling
FDTs specified in the config file, causing the EFI boot code to
unconditionally exit. Remove the blexit() call as it should never
have been here.
Signed-off-by: Roy Franz <roy.franz@linaro.org>
Tested-by: Vijaya Kumar K<Vijaya.Kumar@caviumnetworks.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
The "install" rules depends on both "all" and "subdirs-install" and
"all" depends on "subdirs-all". This leads the "install" rules to call
both "subdirs-all" and "subdirs-install" which create a race with two
concurrent `make` within the same directory (systemd) trying to make the
same things (xen.conf) and failing.
Ultimatly, "install" should only depend on the things it needs to
install, and not on "all".
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Tested-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
- reassign_device_ownership() now tears down RMRR mappings (for other
than Dom0)
- to facilitate that, rmrr_identity_mapping() now deals with both
establishing and tearing down of these mappings (the open coded
equivalent in intel_iommu_remove_device() is being replaced at once)
- intel_iommu_assign_device() now unrolls the assignment upon RMRR
mapping errors
- intel_iommu_add_device() now returns consistent values upon RMRR
mapping failures (was: failure when last iteration ran into a
problem, success otherwise)
- intel_iommu_remove_device() no longer special cases Dom0 (it only
ever gets called for devices removed from the _system_, not a domain)
- rmrr_identity_mapping() now returns a proper error indicator instead
of -1 when intel_iommu_map_page() failed
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Kevin Tian <kevin.tian@intel.com>
Vectors 0-15 are reserved, and a physical LAPIC - upon sending or
receiving one - would generate an APIC error instead of doing the
requested action. Make our emulation behave similarly.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
This reverts commit eac3f5122f.
The "all" target should never depend on "install", it is supposed to only build
not install.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Hvmloader uses the xenstore ring and then tries to reset it back
to its initial state before booting the guest. Occasionally xenstored
will read the ring while it is being zeroed and conclude it has
been corrupted. This prevents PV drivers from loading in the guest.
This patch updates the xenstore ring protocol definition, enabling
a server to advertise additional features to the guest. One such feature
is defined: the ability to cleanly reset the ring including the
higher-level protocol, like an enhanced RESET_WATCHES for rings.
This patch implements the ring reconnection features in oxenstored
and hvmloader, fixing the bug.
This patch also defines an 'invalid' xenstore packet type and uses this
to poison the ring over a reconnect. This will make diagnosing this
bug much easier in future.
Signed-off-by: David Scott <dave.scott@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Reviewed-by: Jon Ludlam <jonathan.ludlam@citrix.com>
We noticed that, if configured to use syslog as the logging backend, every
single line of access logging (via the syslog C binding) will call stat on
/etc/localtime for 3 times. The rational behind this is probably to detect any
timezone changes over time.
This is a considerable cost we'd like to avoid, given the intensiveness of our
access logging --- we log almost every xenstore status change (for good
reason). Also a running Xen host is rarely a mobile environment, so the little
benefit can hardly justify the cost.
Setting up the TZ environment varialbe can avoid stat calls.
Signed-off-by: Zheng Li <dev@zheng.li>
Reviewed-by: David Scott <dave.scott@citrix.com>
Konrad Rzeszutek Wilk
Andrew Cooper
Daniel Kiper
Paul Durrant
Suravee Suthikulpanit
Ian Campbell
David Scott
Olaf Hering
Ian Jackson
Julien Grall
Wei Liu
Jan Beulich
Aravind Gopalakrishnan
Chao Peng
Ian Campbell
Roger Pau Monne
Roy Franz
Anthony PERARD
Zheng Li